- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Palo Alto Networks explores the settings in GlobalProtect Agent while providing some great tips about the CIS controls. Learn more about configuration, best practices, and how to keep security Top of Mind in this webinar video.
If you use GlobalProtect and want to know more about Agent settings and CIS controls, then you have come to the right place.
David Cumbow has hosted yet another great GlobalProtect webinar all about GlobalProtect Agent Settings and CIS Controls, along with a great Q&A session that happened after the webinar.
This time around, David has help from Aaron McAllister, Shane Markley, and Dan Smith whom all play key parts in this great webinar.
Here's a quick overview of the subjects covered in this webinar:
At the end of the webinar, there were actually two different Q&A sessions that I put together to make one video. Here's the Q&A session
A: Hi J. Noble, a few reasons. We make sure to utilize all security controls provided by Zoom, including webinar passwords, encrypted sessions, and we have moderators during the webinar. I think many of the security concerns for Zoom come from the free version and misconfigurations. Thanks for your question!
A: Yes. Please see the following resources for additional detail:
Controlling GlobalProtect VPN Access With OCSP
A: So, as it sits today, HIP notification match on a HIP profile and corresponding HIP Object(s). Within each HIP object you can optionally set checks for things like Domain, OS, registry keys, certificates, etc. Although this approach doesn’t directly map to group memberships, it could potentially provide a similar result. Please see the following resource for additional detail:
Configure HIP-Based Policy Enforcement
Since HIP notifications are a gateway level setting, another option you have is to have another gateway configured for groups that you do want to have HIP notifications and another for those that you don’t. A bit more involved, but it’s an option.
A: Great point, Gene! Thanks for sharing.
A: Not directly from the GlobalProtect client pool, but assuming the firewall is also acting as the DHCP server, the desired outcome can be accomplished as described here:
Configure DHCP Reserved Addresses on a Palo Alto Networks Firewall
A: 5.1.1 is currently "eTac preferred." Here's more information (customer sign-in required):
Support PAN-OS Software Release Guidance
A: Another great point! Thanks, Carl!
A: Hi Eric, I have some thoughts on this, but no corresponding resource or artifact to provide so I will follow up with you offline after this if that is ok.
A: LIVEcommunity answered
A: LIVEcommunity answered
A: LIVEcommunity answered. Just noticed this LIVEcommunity discussion, but let me know if this does not resolve the issue:
GlobalProtect client issues with Windows Hello login - Windows 10
A: "When initially installing the GlobalProtect agent software on the endpoint, the end user must be logged in to the system using an account that has administrative privileges. Subsequent agent software updates do not require administrative privileges."
A: Hi Cody, please see the table on the following page for a feature breakdown with and without theGlobalProtect license:
A: Hi Stephen, as with any great question the answer is it depends. Typically, any noticeable difference in performance from an end user experience perspective is driven by latency associated with traffic needing to traverse the tunnel, hairpin through the firewall, and get back out to the Internet. However, depending upon the configuration that you have in place with Pulse testing IPSec if you are using SSL or vice versa may improve performance as well. If you find that the bottleneck is in fact the speed of your company’s internet connection you might consider evaluating Prisma Access, which is GlobalProtect with a cloud hosted infrastructure:
https://www.paloaltonetworks.com/prisma/access
A: Run a Best Practice Assessment at your convenience from the Customer Support Portal
A: LIVEcommunity answered
A: LIVEcommunity answered
GlobalProtect Quick Configs and Architectures (in Admin Guide)
PAN-OS 8.1 – GlobalProtect Quick Configs
PAN-OS 9.0 – GlobalProtect Quick Configs
PAN-OS 9.1 – GlobalProtect Quick Configs
GlobalProtect Resource List on Configuring And Troubleshooting
The Rapid Response team is here to help if you need implementation help. Reach out to rapid-response@paloaltonetworks.com if you don't know who your team is.
Thanks for taking time to read my blog.
If you enjoyed this, please hit the Like (thumbs up) button, don't forget to subscribe to the LIVEcommunity Blog.
As always, we welcome all comments and feedback in the comments section below.
Stay Secure,
Joe Delio
End of line
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Subject | Likes |
---|---|
3 Likes | |
2 Likes | |
1 Like | |
1 Like | |
1 Like |